Preserve DNS, Kerberos names and time across a pivot

Needs: Reachable correct resolver/KDC path, matching target SPN/hostname, realm configuration and acceptable time

Shell commands

Decide whether the application resolves the name locally, ProxyChains intercepts it, the SOCKS exit resolves it, or the pivot's configured resolver handles it.

Use numeric addresses for route validation; then restore the confirmed hostname when the application protocol requires it.

Kerberos needs an SPN-compatible hostname, realm/KDC route and correct time. A working IP connection does not prove Kerberos naming works.

A temporary host mapping is acceptable only for a confirmed in-scope address/name pair and must be recorded.

# Baseline
getent hosts INTERNAL_FQDN
curl --socks5-hostname 127.0.0.1:1080 http://INTERNAL_FQDN:PORT/
klist
KRB5_TRACE=/dev/stderr kvno cifs/TARGET_HOST

# Baseline
impacket-wmiexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP \
  'DOMAIN/USER@TARGET_HOST'

Verify → Verify resolved destination, ticket/server principal and actual authenticated application action.

If it fails → Do not downgrade the identity claim because transport works. DNS, time, KDC access and service authorization are independent checks. More detail ↓

If → then

A valid ticket/cache or a long-term key that can request a TGT → Inventory, convert and import tickets in the correct logon context
Needs: Matching client/realm/service, valid lifetime, compatible format and available KDC/service routes; ticket import affects a specific context
A password, actual NT hash, AES/NT long-term key or ticket is available → Select password, NT hash, key-to-ticket or ticket authentication
Needs: Credential type accepted by the chosen protocol/client, correct identity/domain, naming/time and destination authorization
Domain credentials or a domain-joined foothold → Establish domain identity, DC, DNS, time and route
Needs: Correct realm/domain and account qualification; reachable DC/services, usable DNS and acceptable clock skew
DNS is an available carrier while simpler permitted routes are unavailable → Conditional: tunnel through controlled DNS infrastructure
Needs: Controlled/delegated domain or supported direct setup, reachable DNS path, compatible server/client and allowed execution

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Preserve DNS, Kerberos names and time across a pivot

USE WHEN: An IP connection works while hostname/Kerberos access fails
STARTING ACCESS: A pivot identity/process or reachable SSH service and a drawn source-to-destination path
RESULT: A route-compatible name and authentication context

Recognize the clue

Compare name resolution, ticket server principals, clock and the KDC path when an IP service works but named authentication fails.

getent hosts TARGET_HOST
klist
date -u

SYNTHETIC EXAMPLE OUTPUT

TARGET_HOST resolves to WRONG_ADDRESS
Ticket server: cifs/TARGET_HOST@REALM
Direct IP transport: works

Means: The route and credential may be valid while name/SPN context is wrong.

Confirm: Check intended DNS source/result, realm/service name, time and KDC/service routes separately.

After validation: Correct naming/time and routes produce accepted service authentication: use that identity-preserving path.
Ruled out in this context: The ticket names another service/host: reject it for this operation.
Still inconclusive: Successful IP transport without named service evidence does not settle Kerberos.

Troubleshooting: Do not downgrade the identity claim because transport works. DNS, time, KDC access and service authorization are independent checks.

Decide whether the application resolves the name locally, ProxyChains intercepts it, the SOCKS exit resolves it, or the pivot's configured resolver handles it.
Use numeric addresses for route validation; then restore the confirmed hostname when the application protocol requires it.
Kerberos needs an SPN-compatible hostname, realm/KDC route and correct time. A working IP connection does not prove Kerberos naming works.
A temporary host mapping is acceptable only for a confirmed in-scope address/name pair and must be recorded.

The first command checks Kali's normal resolver. The curl form deliberately delegates the destination hostname through SOCKS. Do not assume a generic resolver utility will be intercepted by ProxyChains: NSS implementation and process behavior vary.

For Impacket, preserve the target hostname while routing to an IP when the tool supports it:

Why it works

Connection address and Kerberos service identity can be separated by supported client options. Local DNS or an IP substituted for an SPN can break a valid route/credential combination.

Worked example · hypothetical

Observation: SMB by IP connects but Kerberos by hostname fails. Test: inspect resolver result, SPN naming and KDC route. Illustrative output: the hostname resolves outside the intended route. Interpretation: correct name resolution while preserving the service identity.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗